SCAMPI Programmable hardware for network monitoring. Masaryk University

Transcription

1 SCAMPI Programmable hardware for network monitoring Jiří Novotný Masaryk University Arne Øslebø Uninett Jun 8, 2004 Rhodos

2 SCAMPI overview 2.5 year 5 th Framework project Started April partners: CESNET FORTH FORTHNET IMEC Leiden University Masaryk University NETIKOS TERENA UNINETT Main goals: Development of a high-performance intelligent monitoring adapter for 10 Gbps Development of an open and extensible architecture for network monitoring Development of monitoring and measurement tools Investigate strategies and methodologies for monitoring systems operating at 100 Gbps and beyond

3 Applications Intrusion detection uses Snort signatures DOS attack detection based on anomaly detection QoS application packet loss jitter One way delay Flowrep generic report generator with a web frontend for Netflow/IPFIX records

4 MAPI Monitoring Application Programming Interface Design goals: Make it quick and easy to implement new monitoring applications Low overhead Support for multiple concurrent users and applications Global optimization Optimize processing of packets based on all applications from all users Transparent support for different hardware adapters Easy to extend New drivers function libraries Support for: SCAMPI adapter, DAG cards, NIC

5 MAPI (2) Network flow mapi_create_flow Initially all packets seen on the network Apply functions to a flow mapi_apply_functions BPF filter, string search, packet counter, byte counter, Netflow, jitter etc. Read results mapi_read_result mapi_get_next_pkt MAPId Daemon that communicates with hardware devices and processes packets in software

6 Why Programmable Hardware Today s computers are not able to process traffic monitoring at wire speeds PCI bus throughput interrupt latency slow disk access... hardware acceleration ASICs are not flexible enough do not follow changing conditions of the Internet... programmable hardware acceleration SCAMPI adapters are based on COMBO family developed by CESNET and Masaryk University

7 COMBO6

8 COMBO6 Combination of programmable hardware and standard integrated circuits XILINX FPGA (VIRTEX II ) CAM, 3xSRAM, DDRAM, EEPROM PLX, power supply Exchangeable interface cards Test/extension connector Status fully operational

9 COMBO6X New design of COMBO6 2xXILINX II PRO, 3xPower PC processors inside FPGA can bring new ideas in network monitoring Using of FPGA and PCI core instead of PLX chip speed of PCI bus goes up at least to 4Gb/s. With PCI-X core could go up 8Gb/s 3xSRAM, 1xCAM,1xDRAM The COMBO6X with FPGA and PCI core will be ready for redesign to Express PCI in end of 2004 Status in design phase

10 COMBO-4MTX

11 COMBO-4MTX Interface card with 4x1Gb/s copper ports 2xXILINX FPGA (VIRTEX II ) 2xSRAM, EEPROM 4x1Gb ports Status fully operational

12 COMBO-4SFP

13 COMBO-4SFP Interface card with 4x1Gb/s optical ports 2xXILINX FPGA (VIRTEX II ) 2xSRAM, 3xEEPROM 4x1Gb ports in SFP cages (hot swap) hw supports four speeds 1GbE, Infiniband, Fiber channel, OC48 Status fully operational

14 COMBO-2XFP

15 COMBO-2XFP Interface card with 2x10Gb/s optical ports 1xXILINX FPGA (VIRTEX II PRO XC2VP20), Power PC inside 1xSRAM, 1xCAM, 3xEEPROM 2x10Gb ports in XFP cages (hot swap) Status in activation phase

16 COMBO-PTM

17 COMBO-PTM Precise Time Module XILINX FPGA (Spartan 3) 90nm technology MCU Texas Instruments MSP430FI49IPM Precise crystal Connector for GPS (PPM, data) Connector to COMBO6 Status in activation phase

18 SCAMPI Adapters SCAMPI-4MTX COMBO6, COMBO-4MTX, COMBO-PTM SCAMPI-4SFP COMBO6, COMBO-4SFP, COMBO-PTM, 4xSFP transceiver SCAMPI-2XFP COMBO6X, COMBO-2XFP, COMBO-PTM, 2xXFP transceiver Any combination of COMBO6, COMBO6X with, COMBO-4MTX, COMBO-4SFP, COMBO-2XFP is available

19 SCAMPI FIRMWARE Modular design VHDL-standard development approach with simulation Nanoprocessors instead of FSMs Prototyping firmware blocks in SW Hardware/software co-design

20

21

22 SCAMPI SOFTWARE Linux driver Mapi for COMBO6 Software simulator of COMBO6 on top of commodity card Comfort development environment for nanoprograms (nsim) Comboctl loader and comfort debugging

23 More information